Universal XSS in Firefox Focus for iOS

ledoge1 pts0 comments

pocs/firefox at main · v12-security/pocs · GitHub

//files/disambiguate" data-turbo-transient="true" />

Skip to content

Search or jump to...

Search code, repositories, users, issues, pull requests...

-->

Search

Clear

Search syntax tips

Provide feedback

--><br>We read every piece of feedback, and take your input very seriously.

Include my email address so I can be contacted

Cancel

Submit feedback

Saved searches

Use saved searches to filter your results more quickly

-->

Name

Query

To see all available qualifiers, see our documentation.

Cancel

Create saved search

Sign in

//files/disambiguate;ref_cta:Sign up;ref_loc:header logged out"}"<br>Sign up

Appearance settings

Resetting focus

You signed in with another tab or window. Reload to refresh your session.<br>You signed out in another tab or window. Reload to refresh your session.<br>You switched accounts on another tab or window. Reload to refresh your session.

Dismiss alert

{{ message }}

v12-security

pocs

Public

Notifications<br>You must be signed in to change notification settings

Fork<br>129

Star<br>757

FilesExpand file tree

main

/firefox<br>Copy path

Directory actions

More options<br>More options

Directory actions

More options<br>More options

Latest commit

History<br>History<br>History

main

/firefox

Top

Folders and files<br>NameNameLast commit message<br>Last commit date<br>parent directory<br>..<br>README.md

README.md

poc.php

poc.php

View all files

README.md<br>Outline<br>FirefUXSS: Universal XSS in Firefox Focus for iOS via Redirect-Scheme Validation Race Condition

FirefUXSS was discovered with V12 by @RenwaX23 of the V12 security team.

Want to find issues like this in your own code? Try V12 at v12.sh.

Status: 0-day, responsibly disclosed. After remaining unpatched for 11 months, we are now releasing our PoC (see Timeline below).

0608-noaudio.mp4

Proof of Concept

A simplified PoC (poc.php) is included in this repository. It demonstrates script execution against google.com, youtube.com, x.com, and reddit.com.

A live demo is available at https://firefoxuxss.v12.sh .

Responsible disclosure note: We are deliberately not publishing the full weaponized PoC shown in the video--the one capable of account takeover on X, Google, and Reddit--to limit the potential for abuse while the vulnerability remains unpatched.

Summary

Firefox Focus for iOS contains a Universal Cross-Site Scripting (UXSS) vulnerability that allows an attacker to execute arbitrary JavaScript in the security context of effectively any web origin the victim can be steered through. By winning a race condition in the browser's redirect-scheme validation logic, an attacker can smuggle a javascript: (or other dangerous-scheme) navigation past the filter that is supposed to block it, causing the script to run with the origin of the previously loaded document rather than being neutralized.

In practice this means a single click on an attacker-controlled link can result in script execution on high-value origins such as google.com, youtube.com, x.com, or reddit.com — enabling session theft, account takeover, and arbitrary actions on behalf of the victim.

This was reported to Mozilla and remains unpatched. See the Timeline for the full disclosure history.

Background

Every modern browser refuses to follow server-side redirects (an HTTP Location: response header) that point at a dangerous URI scheme such as javascript:, data:, or file:. If a server responds with:

HTTP/1.1 302 Found<br>Location: javascript:alert(document.domain)

a conformant browser will not execute the script — the navigation is dropped or treated inertly, precisely to prevent the exact class of attack described here.

The expected guarantee is: a redirect target's scheme is validated before the navigation is committed , and dangerous schemes are rejected.

Root Cause

Firefox Focus for iOS performs this scheme check, but the check is not atomic with respect to the navigation it guards — it is a classic time-of-check-to-time-of-use (TOCTOU) race.

Under normal load the validator rejects javascript: redirect targets correctly. However, when the redirect-handling path is flooded with a rapid burst of ordinary HTTP→HTTP redirects, the validator can be made to fall behind the navigation pipeline. By timing a final javascript: redirect to land inside this window, the dangerous-scheme check is effectively bypassed: the navigation is committed before (or instead of) being rejected.

Crucially, when the smuggled javascript: navigation does execute, it runs inheriting the origin of the document that was being replaced , rather than as a fresh, origin-less navigation. That origin inheritance is what turns a same-page script execution into a universal XSS — the script runs as google.com, x.com, etc.

The _self requirement

The exploit only succeeds when the malicious page is loaded into the _self browsing context (i.e., navigating the current top-level document in place), not into a new window/tab.

Firefox Focus is a single-window browser with...

firefox navigation scheme javascript focus window

Related Articles